building-soc-playbook-for-ransomware

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's automation agent explicitly fetches and ingests data from public, user-contributed services (see scripts/agent.py: check_id_ransomware -> https://id-ransomware.malwarehunterteam.com, query_nomoreransom -> https://www.nomoreransom.org, query_malwarebazaar_hash -> https://mb-api.abuse.ch/api/v1/), and those responses are parsed and used to set ransomware variant/IOCs that drive containment and scanning actions, so untrusted third‑party content can materially influence agent behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The playbook explicitly instructs privileged, state-changing actions (isolating hosts via EDR APIs, modifying firewall rules, disabling AD accounts, resetting krbtgt keys, disabling services, collecting memory/files) which modify machine and domain state and require elevated privileges, so it should be flagged.